# CodeB -- IBM QRadar log source setup

Docs: https://www.aloaha.com/siem-cookbook.html

CodeB does not push to QRadar; use the QRadar WinCollect agent
(or a Universal DSM over file forwarding) to tail our logs.
European Digital Identity Wallet audit events land in
`codeb-oidc-*.log` and `tmp/wallet-*.log`.

## Step 1 - Deploy WinCollect on each CodeB IIS host

Install WinCollect 10.x. Register the host with your QRadar Console.

## Step 2 - Create a File Forwarder destination per log

Admin -> Log Sources -> "Add" per stream below.

| Log Source Name        | File Pattern                                                            | Category                |
| ---                    | ---                                                                     | ---                     |
| codeb-conn             | `C:\inetpub\wwwroot\WebPhone\App_Data\*\logs\codeb-conn-*.log`   | Application             |
| codeb-oidc             | `C:\inetpub\wwwroot\WebPhone\App_Data\*\logs\codeb-oidc-*.log`   | Authentication          |
| codeb-dial             | `C:\inetpub\wwwroot\WebPhone\App_Data\*\logs\codeb-dial-*.log`   | VoIP                    |
| codeb-cdr              | `C:\inetpub\wwwroot\WebPhone\App_Data\*\logs\cdr\cdr-*.csv`     | VoIP                    |
| codeb-bridge           | `C:\inetpub\wwwroot\WebPhone\tmp\codeb-bridge-*.log`               | VoIP                    |
| codeb-wallet           | `C:\inetpub\wwwroot\WebPhone\tmp\wallet-*.log`                     | Authentication          |
| codeb-iis              | `C:\inetpub\wwwroot\WebPhone\App_Data\weblogs\W3SVC*\*.log`      | Web                     |

Log Source Type: Universal DSM (regex-based parsing).

## Step 3 - Custom Event Properties (regex extractors)

Admin -> Custom Event Properties.

| Property        | Regex                                              | Optimized |
| ---             | ---                                                | ---       |
| CodeB Loud Tag  | `\[([A-Z][A-Z0-9\-]+)\]`                        | yes       |
| Corr ID         | `corr=([A-Za-z0-9\-]+)`                           | no        |
| Tenant Domain   | `tenant=([A-Za-z0-9\.\-]+)`                      | yes       |

## Step 4 - AQL rules

```
SELECT LOGSOURCENAME(logsourceid) AS LogSource,
       "CodeB Loud Tag" AS LoudTag, COUNT(*) AS N
FROM   events
WHERE  "CodeB Loud Tag" LIKE 'RASP-%'
AND    starttime > NOW() - INTERVAL '15' MINUTE
GROUP  BY LoudTag, LogSource
```

```
SELECT LOGSOURCENAME(logsourceid) AS LogSource, payload
FROM   events
WHERE  payload TEXT SEARCH 'TENANT-ISOLATION-BREACH'
AND    starttime > NOW() - INTERVAL '5' MINUTE
```

```
SELECT payload FROM events
WHERE  "CodeB Loud Tag" LIKE 'MDOC-VERIFY%'
AND    payload TEXT SEARCH 'fail'
AND    starttime > NOW() - INTERVAL '15' MINUTE
```

```
SELECT payload FROM events
WHERE  "CodeB Loud Tag" = 'LOTL-CHAIN'
AND    (payload TEXT SEARCH 'broken' OR payload TEXT SEARCH 'untrusted')
AND    starttime > NOW() - INTERVAL '1' HOUR
```

## Step 5 - Offense rules

Create rules that fire when the AQL searches return > 0 events; route
to an offense with severity mapped from LoudTag family:

- `RASP-*`, `MDOC-VERIFY` fail, `LOTL-CHAIN` broken -> High
- `TENANT-ISOLATION-BREACH` -> Critical
- ACL auto-blacklist -> Medium (informational)